Bump deprecated GitHub Action versions in CI - #15

Pushed 81e9cb0f5, which implements all three required changes. The diff is still confined to GitHub Actions configuration (3 files, +142/-25); no application code, tests, snippets, or dependency files are touched.

1. JoshuaTheMiller/conditional-build-matrix@main is gone (python-package.yml)

Replaced with a repo-owned step that reads .github/workflows/matrix_includes.json directly. The only thing that now crosses into the step is the boolean secrets.LMFDB_CI_ACCESS != '', not the password:

      - name: Build test matrix
        id: set-matrix
        env:
          HAS_LMFDB_CI_ACCESS: ${{ secrets.LMFDB_CI_ACCESS != '' }}

matrix_prep.outputs.matrix and the fromJson(needs.matrix_prep.outputs.matrix) consumer are unchanged, and the generated value keeps the {"include":[...]} shape the old action produced under its default addInclude: true. Added permissions: contents: read at the top of the workflow.

2. ovsds/create-or-update-unique-issue-action@v1 is gone (snippet_test.yml)

The reporting path is now a gh-CLI step in a separate report-snippet-errors job that receives the report as an artifact. The setup/test job (checkout, Conda, Julia, Oscar, caches) never holds a token that can write issues, and only report-snippet-errors declares issues: write. The issue body comes from --body-file, so it is never interpolated into a shell command or a workflow expression. The upload happens before the workspace copy is deleted, and the changes.diff / repo-diff behavior is untouched.

git grep -nE 'JoshuaTheMiller/conditional-build-matrix|ovsds/create-or-update-unique-issue-action|actions-cool/issues-helper' -- .github now returns nothing.

3. Julia cache failure semantics restored (snippet_setup/action.yml)

    uses: julia-actions/cache@v3
    with:
      save-always: false
      delete-old-caches: false

Both inputs verified present in the upstream action.yml at tag v3 (both default to true there).

Incident audit: no exploitation, no rotation needed

The timeline closes cleanly, and the compromised code never had a window in which this workflow could reach it.

All 6 snippet_test.yml runs at or after the compromise timestamp, 5 in LMFDB/lmfdb (06-01, 06-15, 07-01, 07-15, 08-01) and 1 in roed-math/lmfdb (08-01), failed at step 1, "Set up job", inside Prepare all required actions, with ##[error]Repository access blocked. Not one workflow step ran in any of them: no checkout, no setup, no issue action. Grepping all six logs for actions-cool/issues-helper|setup-bun|t.m-kosche.com|ACTIONS_ID_TOKEN_REQUEST returns no matches, and the same grep over the 2704-line log of the last pre-compromise run (2026-05-15) is also clean.

Because the next scheduled run after the compromise was 2026-06-01, by which time GitHub had already blocked the repo, there is no run to treat as compromised and no credential to rotate.

Worth noting as a side effect: this is also why the scheduled snippet workflow has been completely dead since 2026-06-01. The earlier failures (2026-03-01 through 2026-05-15) were the Check for diff step doing its job at the end of an otherwise complete run; the June-onward ones never got as far as checking out the repo. Change 2 puts the workflow back into service.

Validation

Actions still cannot be run locally, so the checks on this PR remain the real verification, but the pieces that are plain code were exercised directly:

• All 5 workflow/composite-action files yaml.safe_load cleanly.
• The new matrix step's run: body was executed through bash exactly as written (heredoc and all) against a temporary GITHUB_OUTPUT: HAS_LMFDB_CI_ACCESS=true yields 22 entries covering both servers, matching matrix_includes.json entry for entry; false yields 12 entries, every one of them server == "devmirror", and equal to the devmirror subset of the file. Both write exactly one output line, key matrix, holding compact single-line JSON whose only top-level key is include.
• bash -n on the gh reporting script; the jq title filter returns a number only on an exact title match (empty list gives empty, near-miss title gives empty, exact title gives the number).
• The detect step reports exists=false with no snippet_error_file.md present and exists=true with one.
• Structural assertions on the parsed YAML: only report-snippet-errors carries issues: write, the upload step precedes the delete step, Read error file is gone, and the three diff-check steps survive in order.
• Upstream action.yml re-read for every input this PR relies on: julia-actions/cache@v3 (save-always, delete-old-caches), actions/download-artifact@v8 (node24; name, path), actions/upload-artifact@v7 (if-no-files-found, retention-days), peter-evans/create-pull-request@v8 and peter-evans/autopep8@v2. Every remaining uses: under .github/ is now either a first-party GitHub action on node24, julia-actions/*@v3, conda-incubator/setup-miniconda@v4, peter-evans/*, or the local composite action.

Not exercised: the actual issue create/update path, which needs a deliberate snippet_error_file.md on a throwaway branch, and the autopep8.yml / snippet_generate.yml write paths, which only run on push to main.

The Tests workflow is queued at 81e9cb0f5 but has not started yet: this fork currently has ~95 runs waiting behind a separate CI campaign, so Initial setup (the job that exercises the new matrix step) has not had a runner assigned. This should not be merged until that job goes green and the test matrix fans out as expected.

Deliberately left for follow-up

Keeping this PR to the bump plus the three blockers: SHA-pinning the remaining third-party actions, Dependabot for the github-actions ecosystem, and explicit permissions: in autopep8.yml and snippet_generate.yml (both need contents: write plus pull-requests: write for create-pull-request, so those want scoping rather than clamping, which is a bigger edit than this PR should carry).

One unrelated pre-existing bug spotted while reviewing those two files, not touched here: autopep8.yml guards the formatter step with if: ${{ github.repository }} == 'LMFDB/lmfdb', which expands to the constant string LMFDB/lmfdb == 'LMFDB/lmfdb' and is therefore always truthy. The fork guard does not guard. It wants if: github.repository == 'LMFDB/lmfdb', and the Create Pull Request step below it has no guard at all.

GPT signed off.

Superseded by LMFDB#7152, opened upstream from this same branch. Closing here; review continues upstream. (The write-up on the two removed actions stays linked from the new PR body, so this thread remains the reference for it.)